This invention relates generally to communication networks and in particular to a technique for securing communication at the Data Link Layer (layer 2) of the Open System Interconnection (OSI) Reference Model. The Data Link Layer may provide for reliable transfer of information across the physical layer.
Data transferred over many communication networks are typically sent unsecured, without the benefit of encryption and/or strong authentication of the sender. Sending unsecured data on a communication network may make the data vulnerable to being intercepted, inspected, modified and/or redirected. To make data less prone to these vulnerabilities, many networks employ various security standards and protocols to secure network traffic transferred in their networks. This secured network traffic is typically transferred using data packets that are encoded according to a security standard and/or protocol. As used herein, a secure data packet is a data packet that has been secured using a security standard and/or protocol. Likewise, as used herein, an unsecured data packet is a data packet that has not been secured using a security standard and/or protocol.
One well-known widely-used standard for securing Internet Protocol (IP) traffic is the IP security (IPsec) standard. The IPsec standard comprises a collection of protocols that may be used to transfer secure data packets in a communication network. IPsec operates at layer-3 (L3) which is the network layer of the Open Systems Interconnection Reference Model (OSI-RM). A description of IPsec may be found in Request for Comments (RFC) 2401 through RFC 2412 and RFC 4301 through RFC 4309 all of which are available from the Internet Engineering Task Force (IETF). Two cryptographic protocols that are commonly used to encapsulate IPsec packets are the Authentication Header (AH) protocol and the Encapsulating Security Payload (ESP) protocol.
The AH protocol is primarily used to provide connectionless integrity and authentication of IP datagram traffic. The authentication enables the origin of the traffic to be verified and ensure that the traffic has not been altered in transit. Authentication and integrity of an IP packet is achieved using a keyed one-way hash function, such as Message Digest algorithm 5 (MD5) or Secure Hash Algorithm-1 (SHA-1), in combination with a secret that is shared between a sender of the packet and a receiver of the packet.
Like the AH protocol, the ESP protocol provides a means to authenticate and verify the integrity of IP traffic carried in a secured packet. In addition, the ESP protocol provides a means to encrypt the IP traffic to prevent unauthorized interception of the IP traffic. Like the AH protocol, the ESP uses an ICV to authenticate and check the integrity of a packet. Encryption is used to secure the IP traffic. Encryption is accomplished by applying an encryption algorithm to the IP traffic to encrypt it. Encryption algorithms commonly used with IPsec include Data Encryption Standard (DES), triple-DES and Advanced Encryption Standard (AES).
A payload of an Ethernet packet may be encrypted, however encryption of the payload itself does not support authentication or other security functions as per IPsec. For example, IEEE 802.1AE Media Access Control Security (MACsec) standard integrates security protection into wired Ethernet to secure local area networks (LANs) from attacks. However, IEEE 802.1AE provides only hop-by-hop security, and not complete end-to-end security.